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IN THE CLAIMS: 

1 . (Currently Amended) A method for providing an application to be e x e cut e d for 
installation and execution on a terminal device, the terminal device being arranged 
with a secure environment to which access is strictly controlled by a terminal device 
processor, the method comprising: 

securely p roviding the terminal device (201) with an encrypted application 
f2Q44from a server device via a secure channel for said installation and execution on 
said device ; 

providing, via a secure chann e l (207) into th e s e cur e e nvironm e nt (205), th e 
d e vice (201) with a first k e y for d e crypting said encrypt e d application (20 4 ); 

receiving, at said secure environment, via a secure channel, from a server 
device, a first key for decrypting said encrypted application; 

decrypting, in the secure environment-(2©S), said encrypted application (20 4 ) 
by means of said first key; 

re-encrypting, in said secure environment, the application (209) b y means of 
a second key; and 

storing, outside said secure environment, the re-encrypted application. 

2. (Currently Amended) A method for providing an application to b e e x e cuted for 
installation and execution on a terminal device, the terminal device being arranged 
with a secure environment to which access is strictly controlled by a terminal device 
processor, the method comprising: 

providing the device (201) w ith an encrypted application-(204); 

providing, via a s e cur e chann e l (207) into th e secur e e nvironm e nt (205), th e 
d e vic e (2 0 1) with a first k e y for d e crypting said e ncrypted application (20 4 ); 

receiving, at said secure environment, via a secure channel, from a server 
device, a first key for decrypting said encrypted application; 

encrypting, in said secure environment-(2Q£), said first key by means of a 
second key; and 
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storing, outside said secure environment-(20S), the encrypted first key. 

3. (Currently Amended) The method according to claim 1, the method comprising: 

encrypting, in said secure environment-{20£), said first key by means of the 
second key; and 

storing, outside said secure environment-{20S), the encrypted first key. 

4. (Currently Amended) The method according to claim 1, wherein said second key 
is symmetric and can be derived from the application-(202). 

5. (Currently Amended) The method according to claim 4, wherein said second key 
is comprised in the application (202) itself. 

6. (Currently Amended) The method according to claim 4, wherein said second key 
is generated in the secure environment (205) using an application seed. 

7. (Original) The method according to claim 1, wherein multiple keys can be 
transferred successively on the secure channel into the secure environment, each key 
being used to decrypt a corresponding encrypted application in the secure 
environment. 

8. (Currently Amended) A system arranged to provide an application to b e 
ex e cuted for installation and execution on a device, the device being arranged with a 
secure environment to which access is controlled by a device processor, the system 
comprising: 

means a server for securely p roviding the device (201) with an encrypted 
application £2Q4 4via a secure channel for said installation and execution on said 
terminal device ; 

means for providing, via a s e cure chann e l (207) into the s e cur e environm e nt 
(205), th e d e vic e (201) with a first key for d ec ryptin g s aid encrypt e d application 
(204), 
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an application installation part for receiving, at said secure environment, via 
said secure channel, from said server device, a first key for decrypting said 
encrypted application; 

means a processor for decrypting, in the secure environment-(2Q5), said 
encrypted application (20 4 ) by means of said first key; 

mean ssaid processor for re-encrypting, in said secure environment, the 
application (209) by m e ans o f based on a second key; and 

meafisa memory for storing, outside said secure environment, the re- 
encrypted application. 

9. (Currently Amended) A system arranged to provide an application to be 
e x e cut e d for installation and execution on a terminal device, the terminal device 
being arranged with a secure environment to which access is controlled by a 
terminal device processor, the system comprising: 

meafts a server for providing the device (201) with an encrypted application 
£204} via a secure channel for said installation and execution on said terminal device ; 

means for providing, via a secur e channel (207) into th e s e cur e e nvironm e nt 
(205), th e devic e (201) with a first k e y for d e crypting said e ncrypt e d application 

an application installation part of an application for receiving, at said secure 
environment, via said secure channel, from said server device, a first key for 
decrypting said encrypted application; 

meansa processor for encrypting, in said secure environment-^205), said first 
key by means of a second key; and 

means said processor for storin g in a memory of said terminal device, outside 
said secure environment-(2©£), the encrypted first key. 

10. (Currently Amended) The system according to claim 8, th e syst e m 
comprisin g wherein said processor is : 

m e ans for encrypting, in said secure environment-(20§), said first key by 
means of the second key; and 
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m e ans for storing, outside said secure environment-(2©#), the encrypted first 

key. 

11. (Currently Amended) The system according to claim 8, wherein said second key 
is symmetric and can be derived from the application-(2©2). 

12. (Currently Amended) The system according to claim 11, wherein said second 
key is comprised in the application (202) itself. 

13. (Currently Amended) The system according to claim 11, wherein said second 
key is generated in the secure environment (205) using an application seed. 

14. (Original) The system according to claim 8, wherein the system is arranged such 
that multiple keys can be transferred successively on the secure channel into the 
secure environment, each key being used to decrypt a corresponding encrypted 
application in the secure environment. 

15. (Currently Amended) The method of claim 2, wherein said second key is 
symmetric and can be derived from the application-(303). 

16. (Currently Amended) The method of claim 15, wherein said second key is 
comprised in the application (202) itself. 

17. (Currently Amended) The method of claim 15, wherein said second key is 
generated in the secure environment (205) using an application seed. 

18. (Original) The method of claim 2, wherein multiple keys can be transferred 
successively on the secure channel into the secure environment, each key being used 
to decrypt a corresponding encrypted application in the secure environment. 

19. (Currently Amended) The method of claim 9, wherein said second key is 
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symmetric and can be derived from the application-{202). 

20. (Currently Amended) The method of claim 19, wherein said second key is 
comprised in the application (202) itself. 

21. (Original) The method of claim 9, wherein the system is arranged such that 
multiple keys can be transferred successively on the secure channel into the secure 
environment, each key being used to decrypt a corresponding encrypted application 
in the secure environment. 

22. (New) A terminal device comprising: 

a secure channel, responsive to an encrypted first key downloaded from a 
server for providing said encrypted first key over said secure channel; and 

a secure environment, responsive to said encrypted first key received over 
said secure channel within said terminal device for decrypting said encrypted first 
key for decrypting a protected application part of an application in said terminal 
device. 

23. (New) The terminal device of claim 21, wherein said first key is encrypted by 
said server using a private key belonging to said terminal device. 

24. (New) An integrated circuit comprising a signal processor and a secure 
environment, said secure environment responsive to an encrypted first key from a 
server received over a secure channel for decrypting said first key within said secure 
environment for decrypting an application, for executing said decrypted application 
within said secure environment and for re-encrypting said first key with a key 
belonging to said terminal device for storage on said terminal device outside said 
secure environment so that said first key can be used again within said secure 
environment without need for receipt again of said first key from said server. 
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